The software implements support for an integrated data view over heterogeneous infrastructure and security data. For integration purposes it primarily uses the principle of data normalization into a canonical data model on multiple levels. It consists of a set of components collectively referred to as the data platform based on the Data Lakehouse concept. It is used for processing, retention and analysis of event streams. Other categories of security data are integrated and normalized using adapter components with GraphQL APIs. The resulting query layer integrates all the data interfaces and modeled concepts into a knowledge graph that provides a comprehensive view over the entities of interest in the protected infrastructure.